raccoon | a67e0fd85783e525a3bf49de0daa241f4d7dca55b04164a2bbb71acfdcb94176

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-04-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

89KB
MD5

5f670b0585da1ea77525a49c669a7e5c
SHA1

7f43665d61a654fb36274c3019f650c74f8ad316
SHA256

a67e0fd85783e525a3bf49de0daa241f4d7dca55b04164a2bbb71acfdcb94176
SHA512

0e8a43930b0fed4a36a9098b7c53bb50a6020105c9c9e2b9ef1ea6117537b487a4ea435bf34521a538bc62f390d3782fbc3a42a732cc1e674a5bd90371660f41
SSDEEP

1536:J7Mj9V+6CfcSFzuX40XVfoenKY3iPCtbkMM2UhKikUGgb6Auf:e3JCfHo4iVfXKuiatbhM2UhKiygb56

Score

10^/10

raccoon 8401e21bbb0060afb24ce21fda90f5cb stealer

Malware Config

Extracted

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

http://195.20.16.155:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 5 IoCs

resource	yara_rule
behavioral1/memory/2492-4-0x0000000002220000-0x0000000004220000-memory.dmp	family_raccoon_v2
behavioral1/memory/2672-8-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2672-10-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2672-13-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/2672-16-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 2672	2492	tmp.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2672	WerFault.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2492 wrote to memory of 2672	2492	tmp.exe	29
PID 2672 wrote to memory of 2876	2672	RegAsm.exe	30
PID 2672 wrote to memory of 2876	2672	RegAsm.exe	30
PID 2672 wrote to memory of 2876	2672	RegAsm.exe	30
PID 2672 wrote to memory of 2876	2672	RegAsm.exe	30

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 256
    3⤵
    - Program crash
    PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-0-0x0000000000810000-0x000000000082C000-memory.dmp

Filesize
112KB

Download
memory/2492-2-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2492-4-0x0000000002220000-0x0000000004220000-memory.dmp

Filesize
32.0MB

Download
memory/2492-14-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2672-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2672-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2672-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2672-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2672-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2672-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2672-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download